PHP openssl_csr_sign() Function: Usage and Examples

openssl_csr_sign issues an X.509 certificate from a CSR using a CA or self-signed issuer key, with an explicit validity period.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_csr_sign issues an X.509 certificate from a CSR using a CA or self-signed issuer key, with an explicit validity period.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_csr_sign(OpenSSLCertificateSigningRequest|string $csr, OpenSSLCertificate|string|null $ca_certificate, $private_key, int $days, ?array $options = ..., int $serial = ..., ?string $serial_hex = ...): OpenSSLCertificate|false

Parameter	Purpose
$csr (OpenSSLCertificateSigningRequest\|string)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$ca_certificate (OpenSSLCertificate\|string\|null)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$private_key (mixed)	The corresponding private key; never expose or log its PEM data.
$days (int)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$options (?array)	Driver or algorithm-specific options; avoid unchecked user-controlled settings.
$serial (int)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$serial_hex (?string)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.

The declared return type is shown above. Errors can include false results or exceptions depending on this API: A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Example 1: Basic Operation

A CSR contains a requested subject; it does not automatically prove identity.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($cert instanceof OpenSSLCertificate);

Example 2: A Different Use Case

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'second.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($cert instanceof OpenSSLCertificate);

Practical Example: Checking the Result

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'third.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($cert instanceof OpenSSLCertificate);

Important Behavior and Edge Cases

A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Comparison with Related Functions

Approach	Key distinction
openssl_csr_sign	openssl_csr_sign issues an X.509 certificate from a CSR using a CA or self-signed issuer key, with an explicit validity period.
Related technique	Use openssl_csr_export to serialize the request and openssl_csr_sign to issue a certificate.

Common Beginner Mistakes

Mistake	Correct approach
Confusing this operation with a neighboring cryptographic or security mechanism	Use openssl_csr_export to serialize the request and openssl_csr_sign to issue a certificate.
Ignoring a security prerequisite or failure case	A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Key Takeaways

openssl_csr_sign issues an X.509 certificate from a CSR using a CA or self-signed issuer key, with an explicit validity period.
A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.
Use openssl_csr_export to serialize the request and openssl_csr_sign to issue a certificate.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.